Posted
by
Unknown Lamer
on Wednesday December 12, 2012 @09:58AM
from the nowhere-to-hide dept.

Hugh Pickens writes writes "A suspected terrorist has been taped planning a deadly attack and the police want to use this evidence in court, or someone has been captured on CCTV threatening an assault. Increasingly, recordings like these are playing a role in criminal investigations, but how can the police be sure that the audio evidence is genuine and has not been cleverly edited? Now Rebecca Morelle writes on BBC that a technique known as Electric Network Frequency (ENF) analysis is helping forensic scientists separate genuine, unedited recordings from those that have been tampered with and the technique has already been used in court. Any digital recording made near an electrical power source will pick up noise from the grid that will be embedded throughout the audio. This buzz is an annoyance for sound engineers trying to make the highest quality recordings, but for forensic experts, it has turned out to be an invaluable tool in the fight against crime. Due to unbalances in production and consumption of electrical energy, the ENF is known to fluctuate slightly over time rather than being stuck to its exact set point so if you look at the frequency over time, you can see minute fluctuations and the pattern of these random changes in frequency is unique over time providing a digital watermark on every recording. Forensic Scientist Philip Harrison has been logging the hum on the national grid in the UK for several years. 'Even if [the hum] is picked up at a very low level that you cannot hear, we can extract this information,' says Dr. Harrison. 'If we have we can extract [the hum] and compare it with the database, if it is a continuous recording, it will all match up nicely.'"

more like how can the defense lawyers know the police rent railroading them!

Maybe it's just my bias from having worked with a lot of forensic analysts, but usually it seems that it's the prosecutors trying to railroad the police... not into fabricating evidence, per se, but "looking real hard" for "anything they can come up with". The police don't much like it, unless it's a "known bad guy" they're trying to pin *something* on, because searching for trivial things to make the DA look good wastes time that they don't have (not with one-year case backlogs).

or to be fair,m how can the police prove a tape is genuine when the defense lawyer throws up somew fud

This is the most common problem, but "throwing up some FUD" is called "providing a rigorous defense". After all, if you don't periodically make the police prove they didn't fabricate evidence, then there's less incentive to not fabricate evidence.

usually it seems that it's the prosecutors trying to railroad the police... not into fabricating evidence, per se, but "looking real hard" for "anything they can come up with".

I always thought that's what happened with George Bush and the search for WMDs in Iraq. The intelligence guys tried really really hard to provide evidence for what he wanted them to find. After the invasion, all the evidence was deemed to be crap (or "faulty" or "less reliable than thought").

Ftfs: "how can the police be sure the tape hasn't been edited?" more like how can the defense lawyers know the police rent railroading them! Or how can the police successfully fake an edit! (or to be fair,m how can the police prove a tape is genuine when the defense lawyer throws up somew fud).

The only real defense against accusations of railroading is context. If this technique works, it should at least be possible to demonstrate that chunks of context haven't been removed(ie. the 'ask question', 'stop tape', '6 D-cell maglite', 'start tape', 'tearful confession' use case); but it obviously doesn't magically add recordings that were never taken, that's more of a procedural problem.

People worry about the spectacular but unlikely rather than the common but nonremarkable. They worry about events that kill many people at once, in one location, especially if it involves explosions or words like "bioweapon" "chemical" or "radiation". (they aren't aware that water is a chemical or that light is "radiation")

According to reports by the FBI, 21-year-old Bangladeshi citizen Quazi Mohammad Rezwanul Ahsan Nafis came to the U.S. in January 2012 on a student visa with the explicit goal of carrying out a terrorist attack on U.S. soil. Upon arriving in the U.S., Nafis actively sought out al-Qaeda contacts within the U.S. to assist him in carrying out an attack. Unbeknownst to Nafis, one of the individuals he sought to recruit for his terrorist cell turned out

You don't have to power your stuff from the mains while you create your recording. You'll have your own unique hum, but they won't be able to match that with anything - especially if you get rid of the stuff after that.You could also create your recording purely digitally- no microphones - then there would be no hum except what you choose to artificially add. For example you could record just the hum at a completely different period to throw them off, then to that you add a vocaloid or other voice synthesis

Most respectable recordings eliminate these hums by adding a realtime filter called a "noise gate" that eliminates all sounds of any frequency under XX decibels (usually 20-40). That and most eliminate all noises under XX Hertz (usually also 40) which gets rid of some hums without ruining human voices.

A noise gate only shuts off the sound when the total input level falls below a certain threshold. The noise is still there in the parts that aren't quiet but you can't hear it behind the intentional sound.

Oh yeah, I totally knew that and forgot. That's why I hate noise gate filters and set them at like 20dB because they always tend to cut off the end of what anyone says and their voice fades out and makes the recording sound noisy and low quality when compared repeatedly to the perfectly blank quiet areas.

Most (technically) respectable recordings transfer sound in the range 20Hz ~ 20kHz. Most shoddy recordings are not made using devices that employ digital FFT to get rid of low frequencies entirely. And, filtered analogue signal can still be susceptible to acquiring the hum again. From the space around, from the power supply, from your hand holding the device.

By the way, detecting the utility frequency is a standard technique used in Poland (and, I thus guess, in many other coutries) for years. And it works. Forging the frequency in software is possible (Audacity is mostly enough), if you are a profi that has access to respective databases (or has logged the uf by himself).

The noise gate would only kick in with the sound levels in the recording drop below that 20-40db threshold. You could still overlay the historical 50Hz hum over the rest of the recording where the gate was open. These should still match up. Where it might would not match would be if is 50Hz + harmonics notch filters were applied to the recording specifically to reduce mains hum. This is possible too.

It would still be detectable even with a notch filter. Back when it was still worthwhile to do, I built several stereo amplifiers, either from kits or designs in magazines. Getting rid of the 50hz hum was always the hardest part. Earth loops, wires passing close to the power, you name it, it would make the buggers hum. 50 hz notch filters were common in the cheaper designs, but they would only reduce it. You might gain 30 or 40 decibels with a good one, but modern signal processing will still pull the hum

You're talking about the analog filters, at the point of making the recording. If you used a phone or a digital recorder of some kind, post-recording in the digital domain (with FFT based filters) you can definitely completely remove single frequencies. It creates all kinds of weird watery sounding artifacts and absence of a noise print is suspicious as hell so combined be enough evidence to discount the recording as tampered with. Anyway, post-mangling I wonder if you could overlay your own noise print fro

1. Pet peeve: DFT-based, or freq. domain, filter. FFT, being the algorithm to compute the DFT, has little to do with the actual filtering being done. Anyway, not important.

2. You still can't eliminate the hum that specifically quite like you say, digital or no. Yes it's a lot easier to implement sharper filters in the digital domain, but that has little to do with whether the filtering is done in the freq. or time domain and a lot to do with the ability to run long for loops. Keep in mind that the DFT is on

implement a time-varying notch filter at all the harmonics...well someone must have tried this, right? I wonder how well it works.

That gets me thinking. If you had the historical hum signal and your recording at the same time, you could just invert the historical signal and overlay it onto your recording. The two mirrored hums should cancel each other out. This leaves you with a clean recording that you could then manipulate and then apply a different historical hum when you're done. Pretty simple really.

That's a good point; in addition to tracking the hum from the signal to be modified, you could use other recordings and power plant data to get information about the hum, line it up to your recording, and create an inverse filter.

(Inverting the hum signal in the time domain as I think you were getting at (were you?) wouldn't work well because the each recording will have different spectral and phase responses, so the signal well never cancel out completely and in fact in some cases may amplify. Like how if

Classical noise gate does not work in frequency domain, it simply quietens down the signal if the filtered amplitude is below some threshold. It doesn't eliminate the hum when there's useful signal, the fact it doesn't bother us is simply because our hearing applies psychoacoustic masking. Just because you don't notice it doesn't mean it isn't there.

A modern equivalent of a noise gate works in the frequency domain and looks at spectra of "short" timeslices of the signal. It applies some heuristics for decid

Though you don't even need access to the database. If you know in advance that you're going to need to doctor recordings, you could just record continuously with a modest amount of data, and filter out all but the hum using the inverse of the notch filter.

You can then so more or less the same process without needing a big database.

I strongly suspect that you wouldn't need much more than sox and octave (using fft/ifft) to do this.

If they start believing this, then you could set someone up by making it appear that a recording has happened at a particular time, when it has not.

It's also a question of difficulty. Could the police reasonably have faked DNA evidence? A DNA testing lab might be able to, but the average bobby probably not (yet). On the other hand faking electrical hum is almost trivial, easily done in Audacity. You don't need access to the database, just a recording of your own made at the time you want to fake.

It's also a question of difficulty. Could the police reasonably have faked DNA evidence? A DNA testing lab might be able to, but the average bobby probably not (yet). On the other hand faking electrical hum is almost trivial, easily done in Audacity. You don't need access to the database, just a recording of your own made at the time you want to fake.

http://news.bbc.co.uk/2/hi/europe/7966641.stm [bbc.co.uk]
One woman's DNA was found at more than 40 crime scenes across Germany. The police thought they had a serial killer but it turned out the DNA was from cotton swabs used to collect DNA had been contaminated accidently by a woman working at an unidentified factory.

This wasn't intentional, but it doesn't take a leap to figure out how this might be used to point suspicion at a person. You don't have to convict someone to ruin their life.

So, if I apply a tracking notch to the doctored recordings to remove the original hum and its harmonics, and then superimpose data from the database, I'm all set? Well, thank you!

That was my fist thought too, but my 2nd thought was: So, if I use a hum generator to subtly but abruptly switch between hums then anything they record me saying can be proven fake in court? It's a poor substitute for privacy, but I'll take what I can get; Thanks!

But what's stopping someone now knowing this, and supplanting their own "hum" back into the right place from any recording make anywhere during the time they want to "pretend" to be recording in?

What's actually stopping them ripping out the hum entirely and replacing it with the hum of any arbitrary period of time? If it's in every recording, and you can spot it in, say, CCTV recordings (that use quite primitive recording equipment and compression methods), then it's also incredibly easy to detect and "fake" yourself.

Also, I don't believe it's as reliable as they make out. We'll find out as more cases use it and it will have to be challenged at some point but even speed-cameras that weren't entirely accurate got a lot of people in trouble and then had to be rescinded years later.

And, totally off-topic, it reminds me of my German teacher in school (I'm English, and we were taught German as an optional foreign language). He basically begged me to take his class instead of Double Science, many moons ago, and even called me a "rat" at a parent's evening in front of my dad when I said I wasn't going to study German any more. Turns out he was kinda hoping I'd take German so he could up the average result a bit.

Two years later, he was sacked because the audio recordings of oral work that he sent off for the final exam had "clicks" on the tape (yes, tape!) in between every question where he'd obviously paused it and briefed the children on the right answer.

Wonder how they submit oral coursework now, with MP3's and things? It would be the work of a second to get a perfectly smooth recording of the same thing happening nowadays.

Wonder how they submit oral coursework now, with MP3's and things? It would be the work of a second to get a perfectly smooth recording of the same thing happening nowadays.

At least with spoken-language AP exams, you are allowed to record digitally(if memory serves, the AP people actually tell you to use Audacity); but you are then forced to burn the result to CD, just to remind you that we don't actually live in the future yet...

That was my thought as well. This is somewhat plausible for 24-bit recordings, but that isn't exactly something you see a lot of in the real world (outside of studios). Most recordings are 16-bit. The digital noise floor for 16-bit digital recordings is audible. If you have a 60 Hz hum that is loud enough to really be detected, that is also audible.

I suppose if the bottom bit is not dithered, you might—might—be able to apply some sort of statistical analysis to the data over time and arrive

The noise floor is not that simple.If you analyse the noise, you find it's broadly spread over a wide variety of frequencies.If you analyse 10s or so slices of signal, over the range 47-53Hz, things get considerably easier.10 seconds means that your effective number of signal levels is not 2^16 (65536)It's sqrt(44100*10)*65535, about 25 bits.Throwing out the out of band noise means you lose >99.5% or so of it.

As a practical measure.Go to pretty much any CD you have, and do a FFT in the range 47-53 or 57-63hz.In the vast majority of cases, you will find a signal.

And it's not quite a timestamp, unless the recording is quite long.http://www.nationalgrid.com/uk/Electricity/Data/Realtime/Frequency/Freq60.htm [nationalgrid.com] - for example - this is the UKs last hours frequency.The graph is clearly enough to show that even if you can 'only' resolve in 10 second intervals the frequency, it's quite plausible to say if a 10 minute video can be one specific timeframe, or not.

"The use of the term "patent pending" or "patent applied for" is permitted so long as a patent application has actually been filed. If these terms are used when no patent application has been filed it is deemed as a deceptive act and a fine of up to $500 may be imposed for every such offense.[6] Under the current interpretation of "offense", each mis-marked article constitutes an offense, which permits theoretical damages in the hundreds of millions of dolla

You don't need to detect individual waves. The thing is, electrical hum is supposed to be spot-on 50hz or 60hz (depending on your location), but in reality it drifts around slightly with 50Hz or 60Hz being the *average* frequency. You might have several seconds of 50.01 hz followed by a minute of 49.998 hz and so on.

In other words, if you plot frequency versus time you don't get a straight line at 50 hz, but a line that rise and fall over time while staying on the average very near the goal-frequency.

FFT process gain [designnews.com] to the rescue. Detecting a narrowband pure tone buried well beneath the noise floor of an A/D converter is not all that hard. Don't forget those generating plants have mechanical time constants. They generate pretty damn narrowband signals.

What's actually stopping them ripping out the hum entirely and replacing it with the hum of any arbitrary period of time?

It's not quite so easy to remove noise of this nature, especially if it exists across a broad frequency range. Professional recording engineers have been trying to remove noise from old recordings for decades, and it always has a noticeable effect on the music. I am no sound engineer, but I suspect that this is for two reasons: 1) the presence of the noise destroys some of the musical content, so removing the noise will leave a sonic hole in the recording which cannot be filled because the original musica

What's actually stopping them ripping out the hum entirely and replacing it with the hum of any arbitrary period of time?

Nothing. In court the question will be, "what's the likelihood that it's been faked by sophisticated AV specialists?". It's just one point of data that will be used to determine the ultimate verdict. With enough evidence, say like some planted DNA with your fingerprint, etc. the Jury may put to bed any "reasonable doubt", and find guilty. Think of this next time you get up to leave the coffee house with a strand of your hair on the chair / floor, and toss that almost empty yet DNA laden Starbucks cup, c

I imagine this would only rear its technical head in very limited circumstances, before being kicked from the courtroom altogether when it turns out some kind of process in common recording devices interferes with it's 100% accuracy (noise cancellation,for example, converters on the circuits, etc).

Forensic evidence is admissible even when you cannot guarantee 100% accuracy.

The goal line for conviction is set at " beyond a reasonable doubt" not a distant - impossible - metaphysical - certainty,

I can imagine that some mic designs pick up mains hum particularly well; but others(albeit probably the much less common ones, optical ones, say) should be essentially immune. The power supply also wouldn't be an issue on battery-powered devices, though I'm sure most AC adapters are pretty lousy at filtering.

Is the hum all picked up by the mic, in most commonly used designs, or are there other parts of a recording system that are sensitive to picking up noise?

Do you know if the signal path between mic and amp in the teeny new digital MEMS mics are long and unshielded enough for it to show up on devices using those?

Something like an ADMP441 is a 4.72 mm × 3.76 mm × 1 mm little can with pads, and both the mic and all the analog wrangling are handled inside, external interface is I2S. How much 'we-shielded-it-just-enough-that-the-FCC-doesn't-care' analog signal path would you need before the amplifier?

The thing with noise is it's impossible to eliminate completely. All that can be done is to knock off a few more dB, though I imagine the noise can be reduced to the point where it's sufficiently smaller than the resolution of the ADC that the bits don't shift. That said, any electrical equipment nearby will be producing a hum. Even if we can't hear it, the mic might pick it up. Then there's the magnetic fields affecting sheet metal, causing it to flex.

Faking A/V gets easier and easier. The only way I see to be able to use CCTV records as proof is to upload them to a trusted organisation at real time. The feed should be encrypted, but everytime a court wants to use it as proof they can ask for the recording from the organisation and the key from the owner, and can be sure that the result has not been tampered with.

Or upload just hashes of segments of the recording, preferably signed and timestamped by a public server. The set of possible attacks is the same: a pre-recorded fake, a "suddenly broken" camera, and "oops, my disk broke and there are no backups".

You can't protect against the owners not recording themselves. After all, if they really don't want to appear on tape they won't put up cameras in the first place. Realistically, the footage can't be used against its owner.Prerecorded fakes are a bigger problem, but they are also much harder to do for a number of reasons. First, they require lots of preparation, so they wouldn't work in cases where the crime wasn't, or wasn't properly planned. Second, there are a huge number of unpredictable events, which y

Holy shit, that's amazing and extremely newsworthy, especially on Slashdot where the general consensus that the CCTV pantopicon society is a ineffectual waste of money and an over-reaching of power by asshole cops.

Interesting seeing the different ways people come up with "spoofing" this evidence - I don't know if this is a function of the people on this site or if we've seen too many movies with criminal geniuses.

I'm sure that the video source could be tampered with to "prove" something but I don't know if this makes sense in the real world.

Wouldn't the video (with hum) evidence be provided by the police as proof that the accused committed the crime? In that case, rather than the prosecution proving that evidence provided was false the prosecution would have to just provide the chain of custody for the recordings and if there was any concern wouldn't it be up to the defense to verify the validity of the recordings?

I would think that with the hum information, this could be done fairly cheaply and quickly which would be a good thing for all concerned.

One real-world use would be tying the frequency fluctuations to anchor a recording in time. Remember when Osama bin Laden would send out his tapes via courier, and the CIA would analyze them and say things like "we can tell he's still alive as of last week because he mentioned the Yemen bombing." If his tapes matched a certain frequency pattern, they might have been able to say "we know he recorded this on December 12th, because the hum matches the power grid of Pakistan's Islamabad power generating plant." That also would have proven he was in Pakistan, and might even be why the CIA insisted he was.

With continual monitoring of the world's electrical grid (that doesn't seem like an impossible task for the CIA to do), they can discover in which section of the grid such a signal originated. I was watching some of the University of Tennessee Knoxville's video footage on YouTube [youtube.com] generated by the FNET [wikipedia.org], which shows impacts to the grid rippling across the country over time. Disturbances are surprisingly visible, and the way they spread via propagation delays would act like an echolocator to pinpoint someone who sent the recording. Not only could they tie it to a specific plant, but they could tie it to a subsection of the grid with a known delay.

And they could potentially discover this location without having all the recording instruments in place in advance. If they knew the signatures of the Islamabad generator and the Lahore generator, and they knew the recordings contained signatures delayed by 2 msec from Islamabad and 5 msec from Lahore, they could start quietly plugging in line monitors around Gujrat to map out where such a grid section might be.

Of course, if bin Laden's lighting was from a private generator, which is not uncommon in that area of the world, then they wouldn't know such info. But if he was using commercial electrical power, that might have located him to within a region.

I figured that for measuring the frequency history, they could use modules like the kind the UTK students built. Theirs are cable-modem sized boxes that simply plug into a wall outlet and have an ethernet jack and GPS antenna, and look like they were made for easy construction, simple installation, and unattended operation. An intelligence agency with a lot of resources could have them hidden in out of the way places all around the world. Perhaps they hide them inside wall cavities, or on boxes on electr

So for the database they measure the line frequency by looking for zero crossings in the voltage waveform. They average this over many cycles, which sounds like a good idea but.... If you take 500 cycles over a minute in Europe, this averaging is still equivalent to taking the time between the first and last zero crossing. Or actually that would be the same as taking the average of the periods. Since the frequency is inversely proportional to the period, using the first and last zero crossings would be more

1. Usually digital sound recoding is lossy. This means that a lot of "information" is discarded. Good audio codec would try to eliminate the noise before going on to simplify the "relevant" audible information. You will need to have raw PCM recoding for proper analysis.This method makes a lot more sense with analog recoding.

2. The method rely only on variation of the 50Hz main frequency used for the power grid... it is definitely not as precise.First, low frequencies cause low induction. That's why ac/dc ad

Yes, digital recordings are lossy, but they still would include phase and frequency information for the components that make it into the signal. They may not be shaped perfectly like a sine wave, but over time they will still reflect the true nature of the underlying waveform.

Regarding time of day, this technique may not be able to say "which" of the waveforms at 59.9876 Hz was used. But given enough recording duration, the mapping of transitions from 59.9876 to 59.9900 to 59.9950 to 60.0005 can be mapped

That hum isn't just line voltage. Motors of all sorts, florescent lights, switching power supplies, transformers... the list of things that can generate electrical noise at frequencies close to line frequency is huge. There's no way to reliably separate the noise components when the frequencies are close, so you could never be certain which frequency was the line frequency at any given moment. Without being able to differentiate between the noise sources, you'd never be able to match a recording to the r

The devices you describe don't produce their own 50 or 60 Hz frequency source. That hum, or the related switch mode power supply operating frequency is produced by the instantaneous line frequency. And even more important, the line voltage phase.

A trivial form of analysis would simply check the phase (times between zero crossings) of the background noise. Any sudden shift would signify missing time from the recording. The comparison to a system database simply adds a unique time stamp to the recording.

Virtually all small motors, for example, are non-synchronous (e.g.. they do not run at line frequency). The motor's running frequency is easy to see in a spectrum generated from the power waveform because motors generate electrical noise at their running speed and low level harmonics of their running speed.

The reason people aren't aware of this is that it isn't visible without a rather expensive analyzer and it generally doesn't matter enough t

Virtually all small motors, for example, are non-synchronous (e.g.. they do not run at line frequency). The motor's running frequency is easy to see in a spectrum generated from the power waveform because motors generate electrical noise at their running speed and low level harmonics of their running speed.

You are thinking of induction motors. And while they rotate at less than synchronous speed, the magnetic flux in the air gap does rotate at synchronous speed. The induced rotor currents have a frequency that is dependent on the motors slip, which is perhaps 5% of synchronous speed and therefore very easy to isolate from the synchronous line currents.

The reason people aren't aware of this is that it isn't visible without a rather expensive analyzer and it generally doesn't matter enough to justify spending thousands of dollars on an analyzer that will do them no good. The company I work for happens to make those analyzers, however, so I'm just a teensy bit familiar with this stuff.

It is visible with a strobe light or neon lamp running off line voltage. And while the 'average person' may not be aware of it, this effect is very EE 101 stuff

First off all, I don't believe that the power source of my recording device is affecting my microphone AND my A/D converter and at the final stages the writing of a digital stream to disc or flash.

Secondly to have something like this working, you need a fine grained record of grid fluctuations. Fine grained in the sence that you likely have to put up one 'recorder' per square kilometer.If in my neigbourhood a cR repair shop activates a machine we will have a noticeable fluctuation in grid frequency, which w

What is a "local transients" for you? The local grid? Sorry, there is only one grid... regardless of voltage level all interconnected grid parts are on the exact same frequency, except for local fluctuations that only show up for few milliseconds or seconds.

If you're in an area lit by fluorescent lighting (conventional tubes ; compact fluorescents may or may not work), then you may well be able to pick up the power frequency using video too. Though you'd have to be running your camera at above 100Hz (120Hz in the US and parts of Japan) to be able to pick it up.

(I had contractors blaming their equipment's poor performance on frequency variations in the remote site's power supply ; once I told them that I was running a frequency sensor with a USB oscilloscope,

You don't have to tamper with the analog sound around the microphone, you just have to tamper with the digital recording enough to fool the algorithm the determines the recording is "correct". If you have access to the original recording, the algorithm and the database, you'd be able to do this.

Studies have shown that even innocent suspects will confess when presented with overwhelming (fake) evidence.

The short answer is: yes, at least under steady-state conditions. Large disturbances (losing a generator, for example) create electromechanical transients that propagate throughout the grid at relatively slow speeds (1000 miles/s).My research group studies these things - you can learn more here: http://en.wikipedia.org/wiki/FNETWe also have some people working on the ENF authentication technique.

Am I the only one who saw the "electrichum" tag and thought "electri-chum"? Think electrified chum would work pretty well for fishing. The scent would bring the fish in and the electricity zaps them/dolphins/penguins/scuba divers.